sparkforensics-server 0.5.0 → 0.5.1

package/vendor-core/stage-alignment.js

@@ -0,0 +1,262 @@
+// The stage aligner: two snapshots and options in, typed stage pairs out. Pure (no I/O, no
+// dependency on the CLI, MCP or UI) and deterministic; swapping baseline and candidate mirrors the
+// pairs. `compareRuns` calls it, and every surface that compares runs reads its result
+// (`stagePairs`) instead of comparing stage keys.
+//
+// Pairing keys on `comparisonIdentity`: the `stageIdentity` recipe run with the comparison
+// normalizer, so the volatile tokens that make two runs of one job differ (staging directories,
+// dates, IN-lists, Delta log file counts) and the caller's `--normalize-path`
+// patterns do not split a stage in two. `stageIdentity` itself stays the frozen exact key.
+
+import { normalizeDetail } from './detectors.js';
+import { isDeltaLogRead, scanRelationId } from './plan-summary.js';
+import { withEarlierAttempts, totalExecutorCpuMs } from './run-totals.js';
+import { planNodesOfStage } from './stage-plan-nodes.js';
+import { identityIndexWith, pairEqualCounts, stageIdentityWith,                       } from './stage-identity.js';
+                                                             
+                                                  
+
+/** Version of the comparison block (`stagePairs`, `unmatched`, `replanned`, `bookkeepingStageIds`,
+ * `runtimeCoverage`). Additive changes keep it; a consumer refuses a version it does not know. */
+export const COMPARISON_SCHEMA_VERSION = 1;
+
+// ---- Comparison normalizer ------------------------------------------------------------------
+
+// Targeted patches for the volatile tokens that differ between two runs of one job. Each applies
+// on top of `normalizeDetail`, in this order. No blanket numeric or path stripping: those fuse
+// distinct stages of one run.
+export const COMPARISON_PATCHES                                                                = [
+  // Delta log and file-index file counts track how many files or commits exist, not the query:
+  // DeltaLogFileIndex(4 paths) vs DeltaLogFileIndex(8 paths).
+  { name: 'fileCounts', apply: (s) => s.replace(/FileIndex\(\d+ paths\)/g, 'FileIndex(n paths)') },
+  // Date and timestamp literals: the run's processing window.
+  { name: 'dates', apply: (s) => s.replace(/\d{4}-\d{2}-\d{2}(?:[ T]\d{2}:\d{2}:\d{2}(?:\.\d+)?)?/g, 'DATE') },
+  // IN-lists grow with the window. Spark prints small lists as `IN (a, b)` and large ones
+  // (InSet) as `INSET a, b` with no opening parenthesis.
+  {
+    name: 'inLists',
+    apply: (s) => s.replace(/\bIN \([^()]*\)/g, 'IN (...)').replace(/\bINSET [^()]*?(?=\))/g, 'INSET ...'),
+  },
+  // Random per-run staging directory segments (`/ds/aB3xYz/`): a 6-8 character alphanumeric path
+  // segment that mixes cases, or letters with digits. An ALL-CAPS or all-lowercase name survives,
+  // but a real directory that looks like that (`/output01/`, `/Region3/`) is rewritten too.
+  {
+    name: 'stagingDirs',
+    apply: (s) => s.replace(/\/([A-Za-z0-9]{6,8})(?=\/)/g, (m, seg        ) =>
+      (/[A-Z]/.test(seg) && /[a-z]/.test(seg)) || (/[A-Za-z]/.test(seg) && /\d/.test(seg)) ? '/TMP' : m),
+  },
+];
+
+/** What every match of a caller-supplied pattern is replaced with. */
+export const NORMALIZE_PATH_TOKEN = 'NORMALIZED';
+/** Longest caller pattern accepted. A pattern from an agent can backtrack catastrophically, so
+ * the length is capped; the cap does not make a bad pattern safe. */
+export const MAX_NORMALIZE_PATTERN_LENGTH = 200;
+export const MAX_NORMALIZE_PATTERNS = 16;
+
+/** Compiles caller-supplied normalize patterns (global, every match replaced). Throws an Error
+ * naming the offending pattern when one is too long, not a valid regular expression, or matches
+ * the empty string (which would insert the token between every character). */
+export function compileNormalizePatterns(patterns                               )           {
+  if (!patterns || patterns.length === 0) return [];
+  if (patterns.length > MAX_NORMALIZE_PATTERNS) {
+    throw new Error(`At most ${MAX_NORMALIZE_PATTERNS} normalize patterns are accepted, got ${patterns.length}.`);
+  }
+  return patterns.map((source) => {
+    if (typeof source !== 'string' || source.length === 0) throw new Error('A normalize pattern must be a non-empty string.');
+    if (source.length > MAX_NORMALIZE_PATTERN_LENGTH) {
+      throw new Error(`Normalize pattern "${source.slice(0, 40)}..." is ${source.length} characters; the limit is ${MAX_NORMALIZE_PATTERN_LENGTH}.`);
+    }
+    let re        ;
+    try {
+      re = new RegExp(source, 'g');
+    } catch (e) {
+      throw new Error(`Normalize pattern "${source}" is not a valid regular expression: ${(e         ).message}`);
+    }
+    if (re.test('')) throw new Error(`Normalize pattern "${source}" matches the empty string.`);
+    re.lastIndex = 0;
+    return re;
+  });
+}
+
+/** The detail normalizer the comparison keys use: caller patterns first, on the text as Spark
+ * printed it, then `normalizeDetail`, then the targeted patches. */
+export function comparisonDetailNormalizer(callerPatterns                    = [])                   {
+  return (detail) => {
+    let s = detail;
+    for (const re of callerPatterns) s = s.replace(re, NORMALIZE_PATH_TOKEN);
+    s = normalizeDetail(s);
+    for (const patch of COMPARISON_PATCHES) s = patch.apply(s);
+    return s;
+  };
+}
+
+// ---- Identity and bookkeeping ---------------------------------------------------------------
+
+/** `stageIdentity`'s recipe (normalized stage name plus the attributed nodes' fingerprint) with the
+ * comparison normalizer. Internal to the aligner: consumers key on a pair's `pairId`. */
+export function comparisonIdentity(
+  stage       , snapshot                              , normalizer                  , nodes             ,
+)         {
+  return stageIdentityWith(stage, snapshot, normalizer, nodes);
+}
+
+function isScanNode(node          )          {
+  return /^(Scan|BatchScan)\b/.test(node.name ?? '') || /FileScan|JDBCRelation/.test(node.detail ?? '');
+}
+
+/** True for a stage whose scans only read Delta log files or checkpoints: it has at least one scan
+ * and every scan is internal Delta metadata. Such a stage is table bookkeeping, not query work.
+ * A stage with no attributed plan nodes has no scans to test, so it is never flagged. */
+export function isDeltaBookkeepingStage(
+  stage                                      , sql                        , nodes             = planNodesOfStage(stage, sql),
+)          {
+  let scans = 0;
+  for (const node of nodes) {
+    if (!isScanNode(node)) continue;
+    const name = node.name ?? '', detail = node.detail ?? '';
+    if (scanRelationId(name, detail) !== null || !isDeltaLogRead(name, detail)) return false;
+    scans++;
+  }
+  return scans > 0;
+}
+
+// ---- Alignment ------------------------------------------------------------------------------
+
+export const PAIR_DELTA_METRICS = [
+  'executorRunTime', 'executorCpuTime', 'memoryBytesSpilled', 'diskBytesSpilled',
+  'inputBytes', 'outputBytes', 'shuffleReadBytes', 'shuffleWriteBytes',
+]         ;
+                                                                
+
+                                                                                                       
+
+                            
+                                                              
+                 
+                         
+                         
+                                              
+                                  
+                
+                                              
+ 
+
+                                 
+                     
+                                                                       
+                                                                
+                                                                                  
+                     
+                                                                                              
+                                                                          
+                                                                                                
+                                     
+                                 
+ 
+
+                               
+                                                               
+                                    
+ 
+
+// Sum of a field over the stage's own record and the work its figures leave out (earlier
+// attempts, a failed attempt's late tasks), the same all-attempt sums the run totals use.
+// null when no row carried a finite value, so an unrecorded field is not a false 0.
+function attemptSum(rows         , field                                             )                {
+  let sum = 0, present = false;
+  for (const row of rows) {
+    const v = row[field];
+    if (typeof v === 'number' && Number.isFinite(v)) { sum += v; present = true; }
+  }
+  return present ? sum : null;
+}
+
+function stageFigures(stage       )                                         {
+  const rows = withEarlierAttempts([stage]);
+  return {
+    executorRunTime: attemptSum(rows, 'executorRunTime'),
+    executorCpuTime: totalExecutorCpuMs(rows),
+    memoryBytesSpilled: attemptSum(rows, 'memoryBytesSpilled'),
+    diskBytesSpilled: attemptSum(rows, 'diskBytesSpilled'),
+    inputBytes: attemptSum(rows, 'inputBytes'),
+    outputBytes: attemptSum(rows, 'outputBytes'),
+    shuffleReadBytes: attemptSum(rows, 'shuffleReadBytes'),
+    shuffleWriteBytes: attemptSum(rows, 'shuffleWriteBytes'),
+  };
+}
+
+const ascending = (a        , b        )         => a - b;
+
+/** Pairs the stages of two runs. At this stage the pairing is `matchStages`' algorithm over
+ * `comparisonIdentity`: stages sharing an identity pair off by sorted id when each run has the same
+ * count of them, and every pair is `exact`. */
+export function alignStages(baseSnap                 , candSnap                 , options               = {})                 {
+  const normalizer = comparisonDetailNormalizer(options.normalizePath);
+  // One walk of the plan per stage serves the bookkeeping test and the identity.
+  const index = (snap                 ) => {
+    const nodesOf = new Map                    ();
+    const bookkeeping = new Set        ();
+    for (const [id, stage] of snap.stages) {
+      const nodes = planNodesOfStage(stage, snap.sql);
+      nodesOf.set(id, nodes);
+      if (isDeltaBookkeepingStage(stage, snap.sql, nodes)) bookkeeping.add(id);
+    }
+    const identities = identityIndexWith(
+      snap, (stage, id) => comparisonIdentity(stage, snap, normalizer, nodesOf.get(id)), (id) => !bookkeeping.has(id),
+    );
+    return { identities, bookkeeping };
+  };
+  const base = index(baseSnap), cand = index(candSnap);
+  const baseBook = base.bookkeeping, candBook = cand.bookkeeping;
+  const { pairs: idPairs } = pairEqualCounts(base.identities, cand.identities);
+
+  const baseFigures = new Map                                                ();
+  const candFigures = new Map                                                ();
+  const figures = (cache                    , snap                 , id        ) => {
+    let f = cache.get(id);
+    if (!f) { f = stageFigures(snap.stages.get(id) ); cache.set(id, f); }
+    return f;
+  };
+
+  const pairs              = idPairs
+    .map(({ baseId, candId })            => {
+      const b = figures(baseFigures, baseSnap, baseId), c = figures(candFigures, candSnap, candId);
+      const deltas = {}                                       ;
+      for (const metric of PAIR_DELTA_METRICS) {
+        const [bv, cv] = [b[metric], c[metric]];
+        deltas[metric] = { baseline: bv, candidate: cv, delta: bv != null && cv != null ? cv - bv : null };
+      }
+      return { pairId: `b${baseId}-c${candId}`, baseStageIds: [baseId], candStageIds: [candId], quality: 'exact', score: 1, deltas };
+    })
+    .sort((x, y) => x.baseStageIds[0] - y.baseStageIds[0] || x.candStageIds[0] - y.candStageIds[0]);
+
+  const pairedBase = new Set(pairs.flatMap((p) => p.baseStageIds));
+  const pairedCand = new Set(pairs.flatMap((p) => p.candStageIds));
+  const unmatchedOf = (snap                 , book             , paired             )           =>
+    [...snap.stages.keys()].filter((id) => !book.has(id) && !paired.has(id)).sort(ascending);
+
+  // Run time counts every attempt, the same figure the stage-pair deltas and the run totals use.
+  const runTime = (cache                    , snap                 , id        )         => figures(cache, snap, id).executorRunTime ?? 0;
+  let total = 0, matched = 0;
+  for (const id of baseSnap.stages.keys()) {
+    if (baseBook.has(id)) continue;
+    const t = runTime(baseFigures, baseSnap, id);
+    total += t;
+    if (pairedBase.has(id)) matched += t;
+  }
+  for (const id of candSnap.stages.keys()) {
+    if (candBook.has(id)) continue;
+    const t = runTime(candFigures, candSnap, id);
+    total += t;
+    if (pairedCand.has(id)) matched += t;
+  }
+
+  return {
+    pairs,
+    unmatched: { baseStageIds: unmatchedOf(baseSnap, baseBook, pairedBase), candStageIds: unmatchedOf(candSnap, candBook, pairedCand) },
+    replanned: [],
+    bookkeepingStageIds: { baseStageIds: [...baseBook].sort(ascending), candStageIds: [...candBook].sort(ascending) },
+    runtimeCoverage: total > 0 ? matched / total : null,
+  };
+}

package/vendor-core/stage-identity.js

@@ -0,0 +1,112 @@
+import { cyrb53 } from './string-hash.js';
+import { planNodesOfStage } from './stage-plan-nodes.js';
+                                                  
+                                                             
+
+// The stage-identity recipe, parameterized by the detail normalizer. `stageIdentity` (the frozen
+// exact key, run-comparison.ts) runs it with `normalizeDetail`; the aligner's `comparisonIdentity`
+// runs it with the comparison normalizer. One recipe, so the two keys can differ only in how a
+// detail string is normalized.
+
+                                                          
+
+// Replace run-varying tokens (digit runs, long hex ids) with a stable marker so
+// the same logical stage across two runs normalizes to one identity.
+export function normalizeStageName(name        )         {
+  return String(name)
+    .toLowerCase()
+    .replace(/\b[0-9a-f]{8,}\b/g, '#') // hex ids/uuids first (they contain digits)
+    .replace(/\d+/g, '#')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+// Bottom-up, order-independent structural identity of a resolved plan tree:
+// each node folds its normalized name/detail with its children's digests
+// (children sorted, so AQE picking a different broadcast side still matches),
+// so two plans collide only when their whole shape and every node's detail
+// agree. `normalizeDetail` strips the run-to-run noise (expr ids, `plan_id=`,
+// codegen numbers, AQE build-side choice, commutative-operand order). Each
+// node folds to a fixed-length cyrb53 digest (JSON.stringify-encoded, so
+// detail text containing `<`/`>`/`{`/`,` can't collide two different plans)
+// instead of embedding full child identity strings, which would re-escape
+// every level below and blow identity size up to ~2^depth on the 20-60+
+// operator-deep plans real Spark produces.
+function planTreeIdentity(root                             , normalizeDetail                  )                {
+  if (!root) return null;
+  function visit(node          )         {
+    const childDigests = (node.children ?? []).map(visit).sort();
+    return cyrb53(JSON.stringify([normalizeStageName(node.name ?? ''), normalizeDetail(node.detail ?? ''), childDigests]));
+  }
+  return visit(root);
+}
+
+// Plan identity for the stage's SQL execution, scoped to only the plan nodes
+// this stage actually ran (`node.stageIds`), not the whole tree: two stages
+// sharing one SQL execution (e.g. a self-join's two Exchange stages) otherwise
+// collapse onto one identity regardless of which part of the plan each ran.
+// Falls back to the coarser whole-tree identity when the stage has no
+// attributed nodes (hand-built snapshots without `stageIds`, or unmatched
+// accumulables).
+function sqlNodeIdentity(
+  stage       , snapshot                              , normalizeDetail                  , nodes             ,
+)         {
+  const execId = stage.sqlExecutionId;
+  if (execId == null) return '';
+  const root = snapshot.sql.get(execId)?.planTree ?? null;
+  if (!root) return '';
+  const fingerprints = (nodes ?? planNodesOfStage(stage, snapshot.sql))
+    .map((node) => JSON.stringify([normalizeStageName(node.name ?? ''), normalizeDetail(node.detail ?? '')]));
+  if (fingerprints.length === 0) return planTreeIdentity(root, normalizeDetail) ?? '';
+  return cyrb53(JSON.stringify(fingerprints.sort()));
+}
+
+/** `nodes`: the stage's attributed plan nodes when the caller already has them (`planNodesOfStage`),
+ * so one walk of the plan serves several readers. */
+export function stageIdentityWith(
+  stage       , snapshot                              , normalizeDetail                  , nodes             ,
+)         {
+  return normalizeStageName(stage.name ?? '') + '§' + sqlNodeIdentity(stage, snapshot, normalizeDetail, nodes);
+}
+
+export function identityIndexWith(
+  snapshot                 , identityOf                                      , only                          = () => true,
+)                        {
+  const byIdentity = new Map                  ();
+  for (const [id, stage] of snapshot.stages) {
+    if (!only(id)) continue;
+    const key = identityOf(stage, id);
+    const ids = byIdentity.get(key);
+    if (ids) ids.push(id);
+    else byIdentity.set(key, [id]);
+  }
+  return byIdentity;
+}
+
+/** Pairs the stages of two identity indexes. An identity colliding equally on both sides has no
+ * genuine ambiguity about *count*, so its stages pair off positionally by sorted id rather than
+ * being dropped. This is exact when the identity actually distinguishes stages (e.g.
+ * self-comparing a run: every stage matches itself). It's a best-effort guess when the identity is
+ * coarse (no SQL/attribution) and the two sides are genuinely different runs -- two unrelated
+ * same-named stages could get cross-paired. Accepted tradeoff: dropping them instead would also
+ * sacrifice the exact-self-comparison case, which matters more. An identity with different counts
+ * per side pairs nothing. Deterministic and symmetric: identities visit in sorted order. */
+export function pairEqualCounts(
+  baseIdx                       , candIdx                       ,
+)                                                                                                         {
+  const pairs                                                              = [];
+  const matchedIdentities = new Set        ();
+  for (const identity of [...baseIdx.keys()].sort()) {
+    const candIds = candIdx.get(identity);
+    if (!candIds) continue;
+    const baseIds = baseIdx.get(identity) ;
+    if (baseIds.length !== candIds.length) continue;
+    const sortedBaseIds = [...baseIds].sort((a, b) => a - b);
+    const sortedCandIds = [...candIds].sort((a, b) => a - b);
+    for (let i = 0; i < sortedBaseIds.length; i++) {
+      pairs.push({ identity, baseId: sortedBaseIds[i], candId: sortedCandIds[i] });
+    }
+    matchedIdentities.add(identity);
+  }
+  return { pairs, matchedIdentities };
+}

package/vendor-core/types.js

@@ -156,6 +156,11 @@
                                
              
                              
+                       
+                     
+                           
+                                                                                                        
+                            
                          
  
                                     

package/vendor-core/write-target-args.js

@@ -0,0 +1,48 @@
+// Argument and identifier helpers shared by the write-target parsers (write-targets.ts) and the
+// Delta command resolver (delta-targets.ts).
+const IDENT_PART = String.raw`(?:\`(?:[^\`]|\`\`)*\`|[A-Za-z0-9_$]+)`;
+const IDENTIFIER = new RegExp(`^${IDENT_PART}(?:\\.${IDENT_PART})*$`);
+export const IDENT_PARTS = new RegExp(IDENT_PART, 'g');
+const TRUNCATION_MARKER = /\.\.\.(?:\s*\d+ more fields)?/;
+
+                                                          
+
+// Splits at top-level commas, ignoring commas inside (), [], {} and backticks. `terminated` is
+// true when a comma follows the arg: the last arg of a cut-off string is never terminated.
+export function splitArgs(args        )        {
+  const out        = [];
+  let depth = 0;
+  let quoted = false;
+  let start = 0;
+  for (let i = 0; i < args.length; i++) {
+    const c = args[i];
+    if (c === '`') quoted = !quoted;
+    else if (quoted) continue;
+    else if (c === '(' || c === '[' || c === '{') depth++;
+    else if (c === ')' || c === ']' || c === '}') depth--;
+    else if (c === ',' && depth === 0) {
+      out.push({ text: args.slice(start, i).trim(), terminated: true });
+      start = i + 1;
+    }
+  }
+  out.push({ text: args.slice(start).trim(), terminated: false });
+  return out;
+}
+
+export function isCut(text        )          {
+  return text === '' || TRUNCATION_MARKER.test(text);
+}
+
+// `db`.`t` or db.t -> db.t. A part that itself contains a dot or backtick keeps its quoting.
+export function tableName(ident        )                {
+  if (!IDENTIFIER.test(ident)) return null;
+  const parts = (ident.match(IDENT_PARTS) ?? []).map((p) => {
+    if (!p.startsWith('`')) return p;
+    const inner = p.slice(1, -1).replace(/``/g, '`');
+    return /[.`]/.test(inner) ? p : inner;
+  });
+  return parts.join('.');
+}
+
+/** A write target found without parsing the node's simpleString. */
+                                                                       

package/vendor-core/write-targets.js

@@ -6,10 +6,15 @@
 //   - a target Spark cut short (no delimiter after it, or a "..." marker in it) is unparseable;
 //   - a write-like node outside the known list is reported as an unrecognized write;
 //   - an execution whose plan is not in the model (or whose start event could not be read) is
-//     listed, never skipped, and the count of unreadable log lines is reported.
+//     listed, never skipped, and the count of unreadable log lines is reported;
+//   - a Delta target is set only when exactly one table or path is named (delta-targets.ts,
+//     api-merge-writes.ts).
 // Targets are verbatim from the simpleString: nothing is resolved (relative paths, ${var}
 // placeholders, catalog-relative table names all pass through as the log states them).
 import { walkPlanTree } from './plan-tree-walk.js';
+import { apiMergeWrites } from './api-merge-writes.js';
+import { indexByRoot, isStagedDeltaWrite, parseDeltaTableV2, resolveDeltaCommandTarget,                       } from './delta-targets.js';
+import { IDENT_PARTS, isCut, splitArgs, tableName,          } from './write-target-args.js';
                                                          
 
                               
@@ -67,11 +72,6 @@ const NOT_WRITES = new Set([
   'UpdateEventTimeWatermarkColumn',
 ]);
 
-const IDENT_PART = String.raw`(?:\`(?:[^\`]|\`\`)*\`|[A-Za-z0-9_$]+)`;
-const IDENTIFIER = new RegExp(`^${IDENT_PART}(?:\\.${IDENT_PART})*$`);
-const IDENT_PARTS = new RegExp(IDENT_PART, 'g');
-const TRUNCATION_MARKER = /\.\.\.(?:\s*\d+ more fields)?/;
-
 function commandOf(nodeName        )         {
   return nodeName.replace(/^Execute\s+/, '').trim().replace(/Exec$/, '');
 }
@@ -86,30 +86,6 @@ function isWriteLike(command        )          {
   return (operator.match(/[A-Z][a-z0-9]*/g) ?? []).some((word) => WRITE_WORDS.has(word));
 }
 
-                                                   
-
-// Splits at top-level commas, ignoring commas inside (), [], {} and backticks. `terminated` is
-// true when a comma follows the arg: the last arg of a cut-off string is never terminated.
-function splitArgs(args        )        {
-  const out        = [];
-  let depth = 0;
-  let quoted = false;
-  let start = 0;
-  for (let i = 0; i < args.length; i++) {
-    const c = args[i];
-    if (c === '`') quoted = !quoted;
-    else if (quoted) continue;
-    else if (c === '(' || c === '[' || c === '{') depth++;
-    else if (c === ')' || c === ']' || c === '}') depth--;
-    else if (c === ',' && depth === 0) {
-      out.push({ text: args.slice(start, i).trim(), terminated: true });
-      start = i + 1;
-    }
-  }
-  out.push({ text: args.slice(start).trim(), terminated: false });
-  return out;
-}
-
 // Text after the command name in the simpleString. Empty when the simpleString does not start
 // with the command (so nothing after it can be trusted).
 function argsOf(detail        , command        )         {
@@ -118,21 +94,6 @@ function argsOf(detail        , command        )         {
   return m[2];
 }
 
-function isCut(text        )          {
-  return text === '' || TRUNCATION_MARKER.test(text);
-}
-
-// `db`.`t` or db.t -> db.t. A part that itself contains a dot or backtick keeps its quoting.
-function tableName(ident        )                {
-  if (!IDENTIFIER.test(ident)) return null;
-  const parts = (ident.match(IDENT_PARTS) ?? []).map((p) => {
-    if (!p.startsWith('`')) return p;
-    const inner = p.slice(1, -1).replace(/``/g, '`');
-    return /[.`]/.test(inner) ? p : inner;
-  });
-  return parts.join('.');
-}
-
 // First arg of a path-writing command. The next arg must be the boolean that follows it in
 // InsertIntoHadoopFsRelationCommand, or the static-partition map (INSERT OVERWRITE ... PARTITION
 // (dt='x')) that precedes that boolean, which Spark prints as `[dt=x]` (or `Map(dt -> x)`); this also rejects a path Spark printed with ", " inside.
@@ -259,9 +220,10 @@ function isKnownWrite(command        )          {
 function parseWrite(command        , detail        )                           {
   const argParser = ARG_PARSERS[command];
   if (argParser) return [true, argParser(splitArgs(argsOf(detail, command)))];
-  if (V2_WRITES.has(command)) return [true, parseV2Write(detail)];
+  if (V2_WRITES.has(command)) return [true, parseDeltaTableV2(detail) ?? parseV2Write(detail)];
   if (V2_TABLE_AS_SELECT.has(command)) return [true, parseV2TableAsSelect(splitArgs(argsOf(detail, command)))];
   // A MERGE prints its source relation too, so a delta. path in it may be the source, not the target.
+  // Its target comes from resolveDeltaCommandTarget alone.
   if (command === 'MergeIntoCommand') return [true, null];
   if (DELTA_COMMANDS.has(command)) return [true, parseDeltaPath(splitArgs(argsOf(detail, command)))];
   return [false, null];
@@ -272,14 +234,16 @@ function outputRowsOf(node          )                {
   return metric !== undefined && Number.isFinite(metric.value) ? metric.value : null;
 }
 
-function collectWrites(executionId        , root          , out               )       {
+function collectWrites(exec              , root          , byRoot                  , out               )       {
   walkPlanTree(root, (node) => {
     const command = commandOf(node.name);
     if (!isWriteLike(command)) return;
     const detail = node.detail ?? '';
-    const [recognized, parsed] = parseWrite(command, detail);
+    const [recognized, parsedFromDetail] = parseWrite(command, detail);
+    // A Delta command's simpleString is bare on real logs: its target is found elsewhere.
+    const parsed = parsedFromDetail ?? resolveDeltaCommandTarget(command, exec, node, byRoot);
     out.push({
-      sqlExecutionId: executionId,
+      sqlExecutionId: exec.id,
       nodeId: node.id ?? null,
       command,
       recognized,
@@ -291,6 +255,20 @@ function collectWrites(executionId        , root          , out               )
   }, { dedupe: true });
 }
 
+// A staged Delta write writes the table its root's CTAS/RTAS node names, when it has exactly one.
+function attributeStagedWrites(writes               , sql                           )       {
+  for (const write of writes) {
+    if (write.target !== null || !isStagedDeltaWrite(write)) continue;
+    const root = sql.get(write.sqlExecutionId)?.rootExecutionId;
+    if (root === undefined || root === write.sqlExecutionId) continue;
+    const parents = writes.filter((w) => w.sqlExecutionId === root && V2_TABLE_AS_SELECT.has(w.command));
+    if (parents.length === 1 && parents[0].target !== null) {
+      write.kind = parents[0].kind;
+      write.target = parents[0].target;
+    }
+  }
+}
+
                                     
                                                                                    
                                      
@@ -301,11 +279,16 @@ export function extractWriteTargets(sql                           , input
   const writes                = [];
   const withoutPlan = new Map                                        ();
   for (const id of input.unreadableSqlExecutions ?? []) if (!sql.get(id)?.planTree) withoutPlan.set(id, 'unreadableStart');
+  const byRoot = indexByRoot(sql);
   for (const id of [...sql.keys()].sort((a, b) => a - b)) {
-    const planTree = sql.get(id) .planTree;
-    if (!planTree) withoutPlan.set(id, withoutPlan.get(id) ?? 'noPlan');
-    else collectWrites(id, planTree, writes);
+    const exec = sql.get(id) ;
+    if (!exec.planTree) withoutPlan.set(id, withoutPlan.get(id) ?? 'noPlan');
+    else collectWrites(exec, exec.planTree, byRoot, writes);
   }
+  // DeltaTable API merges run no command node: they are found by their executions' descriptions.
+  attributeStagedWrites(writes, sql);
+  writes.push(...apiMergeWrites(sql));
+  writes.sort((a, b) => a.sqlExecutionId - b.sqlExecutionId);
   const executionsWithoutPlan = [...withoutPlan].sort((a, b) => a[0] - b[0])
     .map(([sqlExecutionId, reason]) => ({ sqlExecutionId, reason }));
   return { writes, executionsWithoutPlan, skippedLines: input.skippedLines ?? null };